Re:When Full-Disk Encryption Goes Wrong
by chadgeidel on Friday May 20, 2016 @01:21PM
(#11739666)
Honest question. What is this you are referring to? I've never heard of a "Full Disk Encryption Drive" and google isn't forthcoming.
[ Parent
| on HN ]
There are HDDs and SSDs that do the encryption themself, rather than just being a dumb storage medium. You need to unlock it with the password or key when using it, and the disk will transparently encrypt and decrypt the contents on reads/writes.
One problem is that you have to trust the disk (manufacturer/firmware) to do this right. This is not so easy to verify yourself, and not all drives claiming FDE are equally secure. https://en.wikipedia.org/wiki/Hardware-based_full_disk_encry...
https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hard...
Trusted Computing Group (TCG) provides a TPM and OPAL spec. The more common term is SED (self encrypting drive) where FDE tends to be software (typically OS). FDE (full drive encryption) is probably better considered "volume encryption" since it applies to file system volumes. It's possible for other volumes and partitions on a drive to not be encrypted.
Many consumer drives are SEDs now. Check out the Samsung 840 EVO which is such a thing. It's always encrypting, it's just that out of the box it's always unlocked (i.e. it provides itself with the DEK at power on).